Cyberwar and civil damage

From the front page of Sunday’s NY Times: the outlines of a continuing debate around the broader, unintended consequences of cyberwar.

This curious section appears about midway through the piece:

But some military strategists argue that these uncertainties have led to excess caution on the part of Pentagon planners.

“Policy makers are tremendously sensitive to collateral damage by virtual weapons, but not nearly sensitive enough to damage by kinetic” — conventional — “weapons,” said John Arquilla, an expert in military strategy at the Naval Postgraduate School in Monterey, Calif. “The cyberwarriors are held back by extremely restrictive rules of engagement.”

Despite analogies that have been drawn between biological weapons and cyberweapons, Mr. Arquilla argues that “cyberweapons are disruptive and not destructive.”

This seems odd, given Arquilla’s previously articulated concerns over “a grave and growing capacity for crippling our tech-dependent society [which] has risen unchecked,” and his advocacy for arms control in this area. Granted, he’s careful to distinguish “mass disruption” from “mass destruction,” but the line between mass disruption and simple destruction seems blurry. There would seem to be a great deal of nuance in advocating international controls on the one hand, and less restrictive rules of engagement on the other.

He does raise a point about interpretative differences as applied to both conventional and cyberweapons. Should there be a difference, especially if the full extent of collateral effects are unknown? The case study here might be electrical infrastructure – especially since it’s been featured so prominently in Department of Homeland Security arguments. As the LA Times has noted, the U.S. attack on Iraq in 2003 deliberately avoided attacks on electrical infrastructure – a significant change from the 1991 campaign, and its second- and third-order effects. If an attack on information networks has the same effect on electrical infrastructure as a conventional attack, should it be governed by the same rules? Or if it has the same second- and third-order effects as an attack on electrical infrastructure – regardless of whether or not the electrical infrastructure is targeted – should it be governed the same?

Underlying this debate is the simple trend towards a more integrated world, in material, communications, and social networks. It’s not a flat world by any measure, but the wiring continues to be put in place. As that happens it’s going to be even more difficult to separate warfare from its effects on civil society. So it’s important that this debate continue – to ensure, at a minimum, that the use of information systems to conduct war works to inhibit rather than encourage war.